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adequate over a reasonable period of time to prevent 
erasure. In still further aspects, the invention includes 
temperature sensing means which generates an elec- 
trical signal responsive to a temperature which is lower 
than a predetermined value and which signal is used to 
cause the erasure of information contained in the mem- 
ory component, before the temperature of the memory 
component has reached a temperature low enough to 
cause a significant number of its storage locations to re- 
tain their information even after erasure is attempted. 

These aspects of the invention are achieved by the 
barrier of claim 1 . 

Description of the Drawings 



Fig. 1 



Fig. 2 



Fig. 3 



Fig. 4 
Fig. 5 

Fig. 6 
Fig. 7 

Fig. 8 

Fig. 9 
Fig. 10 



is an exploded perspective view of a circuit 
card with various devices and components 
mounted thereon which constitute the sys- 
tem to be protected, and, showing plastic 
preforms which mate with the card to provide 
the form-factor for wrapping the flexible 
screen membrane; 

is a perspective view, somewhat diagram- 
matic showing a flexible screen member 
used in this invention; 

is the system of Fig. 3 showing the flexible 
screen member partially wrapped thereon 
with screen leads attached to the circuit 
card; 

is a sectional view taken substantially along 
the plane of line 6-6 of Fig. 5; 

is a view similar to Fig. 5 in which the screen 
is wrapped onto the circuit card with parts 
broken away for clarity; 



is a circuit diagram of a circuit used for de- 
tecting mechanical or chemical intrusion 
through the screen member: 



Fig. 1 1 is a circuit diagram of the circuit used for de- 
tecting and obtaining of data by use of high 
intensity radiation: and 

5 Fig. 1 2 is a circuit diagram of the circuit used for de- 
tecting and preventing obtaining of informa- 
tion by low temperature excursions. 
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is a schematic view of a message encryp- 
tion/decryption system; 

is a schematic view of the operation of the 
encryption/decryption system and means to 20 
detect and prevent unauthorized interroga- 
tion of the system; 
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is a view similar to Fig. 6 showing the assem- 
bly encapsulated in epoxy and contained in 
a steel container; 50 

is a sectional view taken substantially along 
the plane of line 9-9 of Fig. 8: 



55 



Description of an Embodiment 

Referring now to the drawings and for the present 
to Fig. 1 , a conceptual schematic drawing of a message 
encryption\decryption facility is shown in broken outline 
10. The clear message which is to be encrypted is de- 
livered to encryption means 12 which in turn encrypts 
the clear message via key store 14 to provide an en- 
crypted message. The encryption keys in key store 14 
as well as the encryption 12 must be protected from in- 
terrogation because if an unauthorized person were to 
have access to these keys and the encryption process, 
the clear messages could be derived from encrypted da- 
ta and misused indiscriminately. 

The conceptual block diagram in Fig. 2 shows the 
scheme of the present invention for detecting and pre- 
venting unauthorized interrogation of the stored encryp- 
tion keys in key store 14. For the purpose of this inven- 
tion, the encryption keys are retained in a volatile mem- 
ory 16. The volatile memory 16 is powered by either a 
battery or system power determined by power switch 1 8. 
Power to the memory is controlled by power gate 20 and 
shorting transistor 21 via detection logic NAND gate 22 
which in turn is actuated by sensor circuits designated 
S, T and X. (Of course, more sensor inputs could be 
used if desired.) Sensor circuit S, which will be de- 
scribed presently in detail, detects mechanical or chem- 
ical intrusion; sensor circuit T, which will be described 
presently in detail, detects temperature excursions: and 
sensor circuit X, which will be described presently in de- 
tail, detects exposure to radiation. As is well known in 
the art, the logic NAND gate 22 will normally be in the 
"low" or "off" condition if all inputs are "on" or "high"; how- 
ever, if any input goes "low", then the NAND gate output 
22 goes "high" providing a signal to other components 
attached to it. Such a signal from the NAND gate output 
will cause the power gate 20 to disconnect the memory 
16 from power and cause shorting transistor 21 to short 
the power pin of the memory to ground thus erasing the 
memory quickly. Thus, if any one of the sensor inputs 
changes from "high" to "low", as a result of certain pre- 
determined conditions indicating an attack the NAND 
gate 22 will turn "on" and the data from memory 16 will 
be quickly erased. Each of these particular detecting cir- 
cuits will be described presently. 

As shown in Fig. 3, a circuit card 24 is provided 
which contains thereon the various components for en- 
cryption, key storage in volatile memory 16. the battery 
and the protection circuitry for the volatile memory for 
the encryption/decryption facility 10. The components 
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36 or 37 is substantially increased or decreased beyond 
the bounds set by resistor 55, the bias of the operation 
amplifiers 57 and 58 will change such that one or the 
other will turn "off" thus changing the input to NAND gate 
22 from "high" to "low". As explained previously, this will 5 
cause the output of NAND gate 22 to go from "low" to 
"high", supplying the necessary signal to turn "off" power 
gate 20 and turn "on- shorting transistor 21 which will 
quickly erase the information stored in volatile memory 
16. The change in resistance of legs 36 or 37 can be 10 
due either to breaks or shorts in either of the legs caused 
by an attempted intrusion, or by a slow change in resist- 
ance of the legs 36 or 37 caused by a chemical attack 
or by other means. Thus, the circuit shown in Fig. 1 0 will 
respond to attempted mechanical or chemical intrusions is 
by sending a signal to the NAND gate 22 which in turn 
will send a signal to cause the erasure of information 
before the intrusion is complete and the volatile memory 
can be read. 

As indicated previously, there are various special 20 
attacks whereby screen barriers can be thwarted, com- 
promised, or by-passed without losing data or memory, 
if extra precautions are not taken. Two such attacks in- 
volve controlled exposure to ionizing radiation and, ex- 
posure to low temperatures. The circuitry shown in Fig. 25 
1 1 , detects both visible and ionizing radiation and caus- 
es the memory 16 to be erased before ionizing radiation 
is able to permanently affect the volatile memory. The 
circuit in Fig. 12 detects temperature excursions below 
a predetermined value and causes the memory to be 30 
erased before a critical low temperature affects the vol- 
atile memory. 

The circuit for Sensor X, which is responsive to both 
visible and ionizing radiation is shown in Fig. 11. This 
circuit includes an operational amplifier 62 having one 35 
side connected to diode 63 in series with a resistor 64, 
the combination of which provides a reference voltage 
to the positive input of the operational amplifier 62. The 
negative input of the operational amplifier 62 is connect- 
ed between a photo sensitive device 65, such as a Pho- *o 
to-Darlington pair or a phototransistor, and resistor 66 
to system power or battery via power switch 18 and 
through resistors 67 to ground. Capacitors 68 and 69 
and resistors 66 and 70 have been provided for noise 
filtering. The photosensitive device is located on the 
card 24 so that it is not blocked by the lead foil sheets 
29, preferably adjacent to the volatile memory chip 16 
under the notch 30 of the lead foil sheet such that at- 
tempted radiation of this component 16 will also expose 
the photosensitive device 65 to radiation. In normal op- so 
eration, the photosensitive device 65 is nonconducting 
in the absence of radiation and the operational amplifier 
62 is biased "on". However when the photosensitive de- 
vice senses radiation (either ionizing or in the visible 
spectrum) of sufficient intensity, it will conduct current ss 
which will change the bias on the operational amplifier 
62 turning it "off". This will cause the NAND gate 22 to 
turn "on" and provide a signal to power gate 20 and 



shorting transistor 21 to cause information stored in vol- 
atile memory 16 to be erased as previously described. 

The circuitry of Sensor T is shown in Fig. 12. In this 
circuit three resistors 72, 74 and 76, together with resis- 
tor 70, provide the four legs of a bridge circuit, which 
circuit is connected to operational amplifier 78. Resistor 
70 is a thermistor having a negative temperature coef- 
ficient of resistance, i.e. its resistance increases with de- 
creasing temperature. The value of the three resistors 
72, 74 and 76 are chosen to bias operational amplifier 
78 normally "on" within the operating temperature 
range, and to bias the amplifier "off" at a chosen tem- 
perature. The value of resistor 76 is chosen based on 
the temperature characteristics of thermistor 70. Thus 
in normal operation the operational amplifier 78 is nor- 
mally biased "on", but when the temperature falls below 
a selected low value, e.g. 0°C or -20°C or some other 
value related to the temperature dependent retention 
characteristics of volatile memory 16, the operational 
amplifier 78 will turn "off" which as described above, will 
cause the NAND gate to give a signal which will cause 
erasure quickly of the information stored in volatile 
memory 18. 

While one embodiment of this invention has been 
shown and described various adaptations and modifi- 
cations may be made without departing from the scope 
of the invention as defined in the appended claims. For 
example, the NAND gate can be replaced with other log- 
ic circuits performing a logical "or" function to cause 
erasure of the memory if any one of a number of events 
are sensed indicating that an intrusion is being attempt- 
ed. Additional sensors could be used to detect other ev- 
idence of intrusion. 



Claims 

1. A barrier for protecting against intrusions into an y/ 
electronic assembly comprising; 

screen means surrounding said electronic as- 
sembly, said screen means including line v 
means (33) formed on a substrate (31 ) in a pat- v 
tern, said screen means resisting access with- 
out disturbing said line means, said line means ^ 
being formed of conductive particles (34) of ma- 
terial disposed in a solidified matrix of material, u 
the resistance of said line means changing 
when said line means are disturbed, \S 

encapsulating material (46) encapsulating said 
line means and bonded to said line means ^ 
which bond is stronger than the bond of said 
line means to said substrate (31 ) and which en- ' 
capsulating material is harder and more brittle 
than said line means, and which encapsulating 
material is subject to _ attack by the same rea- 
gents with respect to their chemical properties 



5 



11 



EP 0 417 447 B1 



12 



wordenen Materiatmatrix bestehen, und der 
Widerstand der Leitungsmittel sich andert. 
wenn die Leitungsmittel gestdrt werden, 

ein Einkapselungsmaterial (46), das die Lei- 
tungsmittel einkapselt und mit den Leitungsmit- 
teln verbunden (Bondverfahren) ist, wobei die- 
se Verbindung starker als die Verbindung der 
Leitungsmittel mit dem Substrat (31) ist, und 
wobei das Einkapselungsmaterial harter und 
bruchiger als die Leitungsmittel ist und Angrif- 
fen von denselben Reagenzien und ihren che- 
mischen Eigenschaften ausgesetzt ist, die 
auch das Material der Matrix der Leitungsmittel 
angreifen; 

und ein Stromversorgungs- und Signalerfas- 
sungsmittel, das den Leitungsmitteln ein Ein- 
gangssignal bereitstellt und ein Ausgangssi- 
gnal erzeugt, wenn der Widerstand der Lei- 
tungsmittel sich andert. 

2. Eine Schutzsperre nach Anspruch 1, bei der die 
elektronische Anlage ein fluchtiges Speichermittel 
umfaBt, und bei der auf das Ausgangssignal rea- 
gierende Mittel bereitgestellt werden, urn die im 
fluchtigen Speichermittel gespeicherten Daten zu 
loschen. 

3. Eine Schutzsperre nach Anspruch 1 oder 2, bei der 
die Leitungsmittel weiterhin zahlreiche Leitungs- 
segmente umfassen : und bei der das Stromversor- 
gungs- und Erfassungsmittel Widerstandsanderun- 
gen zwischen zwei Leitungssegmenten erfaBt. 

4. Eine Schutzsperre nach Anspruch 3, bei der die Lei- 
tungsmittel einen Teil einer Spannungsteilerschal- 
tung bilden. 

5. Eine Schutzsperre nach Anspruch 4, bei der Mittel 
bereitgestellt werden, urn das Ausgangssignal zu 
erzeugen, das auf die Widerstandsanderung der 
Leitungssegmente in der Spannungsteilerschal- 
tung reagiert 

6. Eine Schutzsperre nach Anspruch 5, bei der das 
Ausgangssignal durch ein Verstarkermittel erzeugt 
wird, das an die Spannungsteilerschaltung ange- 
schlossen ist. 

7. Eine Schutzsperre nach einem der Anspruche 1 bis 
6, die weiterhin ein Mittel zum Erfassen einer unter 
einem gegebenen Temperaturwert liegenden Tem- 
peratur und zum Erzeugen eines Ausgangssignals 
umfaBt, das auf die Erfassung der Temperaturab- 
weichung reagiert. 

8. Eine Schutzsperre nach einem der Anspruche 1 bis 



6. die weiterhin ein Mittel zum Erfassen von Strah- 
lung uber einem gegebenen Wert und zum Erzeu- 
gen eines Ausgangssignals umfaBt, das auf die er- 
faBte Strahlung reagiert. 

5 

9. Eine Schutzsperre nach einem der Anspruche 1 bis 
6, die weiterhin ein Mittel zum Erfassen einer unter 
einem gegebenen Temperaturwert liegenden Tem- 
peratur und zum Erzeugen eines Ausgangssignals 

10 umfaBt, das auf die Erfassung der Temperaturab- 
weichung reagiert, sowie ein Mittel zum Erfassen 
von Strahlung uber einem gegebenen Wert und 
zum Erzeugen eines Ausgangssignals, das auf die 
erfaBte Strahlung reagiert. 

is 

10. Eine Schutzsperre nach Anspruch 7 Oder 9, bei der 
das Mittel zum Erfassen der Temperaturabwei- 
chung ein Schaltungsmittel mit einem Mittel zum 
Bereitstellen eines Bezugssignals umfaBt, urn die 

20 Reaktion auf die Temperaturabweichung zu steu- 
ern. 

11. Eine Schutzsperre nach Anspruch 10, bei der das 
Schaltungsmittel ein temperaturempfindliches Wi- 

?5 derstandsmittel umfaBt, das seine Ausgaben in Ab- 
hangigkeit von der Temperatur verandert. 

12. Eine Schutzsperre nach Anspruch 11, bei der das 
Schaltungsmittel eine Bezugsbruckenschaltung ist. 

13. Eine Schutzsperre nach Anspruch 11 oder 12, bei 
der das Ausgangssignal von einem Verstarker er- 
zeugt wird, der mit dem Schaltungsmittel verbun- 
den ist. 

5 

14. Eine Schutzsperre nach Anspruch 8 oder 9, bei der 
das Mittel zum Erfassen der Strahlung ein Schal- 
tungsmittel mit einem Mittel, insbesondere einer 
strahlungsempfindlichen Vorrichtung, umfaBt, urn 

0 ein Merkmal zu andern, das auf die erfaBte Strah- 
lung reagiert. 

15. Eine Schutzsperre nach Anspruch 14, bei der das 
Schaltungsmittel einen operationsverstarker um- 

> faBt : der das Ausgangssignal erzeugt. 

16. Eine Schutzsperre nach einem der oben genannten 
Anspruche 8, 9, 1 4 oder 1 5, die weiterhin ein Strah- 
lungsabschirmmittel umfaBt, urn die vom fluchtigen 

> Speicher empfangene Strahlung verglichen mit der 
vom Strahlungserfassungsmittel empfangenen 
Strahlung zu verringern. 

1 7. Eine Schutzsperre nach einem der Anspruche 2-1 6, 
bei der Gattermittel bereitgestellt werden, urn das 
Ausgangssignal zu erzeugen, und/oder Schaltmit- 
tel, urn den Strom fur den fluchtigen Speicher, der 
auf das Ausgangssignal reagiert, abzuschalten. 
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par un amplificateur relie audit moyen de circuit. 

14. Barriere de protection selon la revendication 8 ou 
9 : dans laquelle ledit moyen destine a detecter un 
rayonnement comprend un moyen de circuit com- s 
portant un moyen, en particulier un dispositif pho- 
tosensible, afin de faire varier une caracteristique 

de celui-ci en reponse audit rayonnement detecte. 

15. Barriere de protection selon la revendication 14, 10 
dans laquelle ledit moyen de circuit comprend un 
amplificateur operationnel qui produit ledit signal de 
sortie. 

16. Barriere de protection selon Tune quelconque des '5 
revendications precedentes 8, 9, 14ou 15, compre- 
nant en outre un moyen de blindage contre les 
rayonnements dispose pour reduire le rayonne- 
ment recu par ladite memoire volatile par rapport 
aux rayonnements recus par ledit moyen destine a 20 
detecter un rayonnement. 

17. Barriere de protection selon Tune quelconque des 
revendications 2 a 16, dans laquelle un moyen de 
porte est prevu pour generer ledit signal de sortie, 25 
et/ou un moyen d'interrupteur destine a couper I'ali- 
mentation vers ladite memoire volatile en reponse 

au signal de sortie. — 

18. Barriere de protection selon la revendication 17, 30 
comprenant en outre un moyen de transistor desti- 
ne a court-circuiter ladite memoire volatile en re- 
ponse audit signal de sortie. 

19. Barriere de protection selon Tune quelconque des 35 
revendications 2 a 18, comprenant en outre un 
moyen destine a procurer un blindage contre les in- 
terferences electromagnetiques. 

40 
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